CVE-2026-86160: SourceCodester Online Voting System ajax.php delete_voting sql injection
A vulnerability has been found in SourceCodester Online Voting System 1.0. The affected element is an unknown function of the file /ajax.php?action=deletevoting. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability can be exploited remotely and does not require privileges or user interaction, according to the supplied CVSS vector. Systems exposing the affected ajax.php endpoint to reachable attackers are therefore at risk.
What must an attacker send to trigger the vulnerability?
An attacker manipulates the ID argument for the /ajax.php?action=delete_voting endpoint. The supplied data identifies this input as leading to SQL injection.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.